Month Archives: May 2011

nProbe

NetFlow-Lite and nProbe: a Tutorial
Today we have held a webinar about NetFlow-Lite with both Cisco and Plixer. Subscribers of this blog should know by now what is NetFlow-Lite and why nProbe is necessary to exploit this technology. Nevertheless you might be interested to know more about NetFlow-Lite, both in terms of features and usage scenarios. Below you can find a could of presentations about this topic that I think are worth reading: ntop, Implementing a NetFlow Cache for NetFlow-Lite Cisco Systems, Catalyst 4948E NetFlow-lite ntop, Using nProbe as NetFlow-Lite Aggregator In interested, you can also see the video …
nProbe

Invitation to NetFlow-Lite Webinar
As most of you know, nProbe has recently added NetFlow-Lite support in 6.5 release. NetFlow-Lite is a protocol that brings you visibility into switched networks, similar to what NetFlow “classic” is doing on routed networks. As this technology is pretty new, perhaps you might be interested in hearing more about it right from the source. I would like to invite you to this free webinar that will take place later this week. Shall you be interested please register now. Cisco NetFlow-Lite: Enabling Traffic Monitoring at Data Center Access Date: May …
nProbe

Using nProbe as NetFlow-Lite Cache
As previously stated on this blog, we have worked tightly with Cisco as nProbe has been selected as reference implementation for NetFlow-Lite flow conversion. Although NetFlow-Lite support has been added to nprobe since version 6.1.4 and it’s available on all supported platforms (both Unix and Windows), with nProbe 6.5 (just released) we have moved NetFlow-Lite support to the next level. This is because nProbe now features both a Specialized plugin for NetFlow-lite flow collection that increases of 5x times the collection performance. PF_RING kernel plugin (Linux only) that can convert …
PF_RING

Going beyond RSS (Receive-Side Scaling)
When RSS was introduced some years ago, operating systems had the chance to scale also when handling network packets as RSS allowed incoming packets to be distributed across processor cores. Unfortunately RSS uses a one-way hash, that while distributes packets heavenly across queues, it has some drawbacks. The main one is that if you have a connection A <-> B, packets A->B will go on queue X, and those of B->A on queue Y, where X <> Y. This is a major issue for applications, as you cannot assume that …
PF_RING

Packet Capture Performance at 10 Gbit: PF_RING vs TNAPI
Many of you are using PF_RING and TNAPI for accelerating packet capture performance, but have probably not tested the code for a while. In the past month we have tuned PF_RING performance and squeezed some extra packets captured implementing the quick_mode in PF_RING. When you do insmod pf_ring.ko quick_mode=1, PF_RING optimizes its operations for multi-queue RX adapters and applications capturing traffic from several RX queues simultaneously. The idea behind quick_mode is that people should use it whenever they are interested just in maximum packet capture performance, and do not need …
Announce

Power to see all
Almost a decade ago Dr Ian Graham was in Europe for a series of conferences and I have met him in person along with other people from Politecnico di Torino, that were developing winpcap (one of the key guys of the group, Loris Degioanni, at that time was visiting Endace, thus was not present at the meeting. Loris later become a successful entrepreneur having founded Cace, now Riverbed). For me it was a big pleasure to have such meeting, as Endace was in the early days (and also all of …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe